package com.westos.core.impl;

import com.westos.bean.RiskBean;
import com.westos.core.ScanRiskXss;
import com.westos.utils.GetCode;

import java.io.*;
import java.util.ArrayList;
import java.util.List;

public class ScanRiskXssImpl implements ScanRiskXss {
    private List<RiskBean> list = new ArrayList();//存储漏洞 (文件夹/件名+行数+错误名称+错误代码)

    public List<RiskBean> scan(File file, Integer taskid) {
        BufferedReader bufferedReader = null;
        try {
            bufferedReader = new BufferedReader(new FileReader(file));
        } catch (FileNotFoundException e) {
            e.printStackTrace();
        }

        String filepath = file.getParent() + file.getName();
        //System.out.println("filepath:" + filepath);
        String line = null;
        String fullstr = "";
        int num = 0;
        try {
            while ((line = bufferedReader.readLine()) != null) {
                num++;
                fullstr += line;
                if (fullstr.contains("<%") && fullstr.contains("%>")) {
                    String str = line.replaceAll(" ", "");
                    //System.out.println(str);
                    if (str.contains("request.getParameter") && str.contains("<%")) {
                        //System.out.println("准备获取错误代码");
                        //<%
                        //
                        //String name= request.getParameter()
                        // %>
                        String riskcode = GetCode.getCodeByNum(file, num);//拿到当前sql注入行的上下文
                        //封装到riskbean
                        RiskBean riskBean = new RiskBean();
                        riskBean.setFilepath(filepath);
                        riskBean.setRownum(num);
                        riskBean.setRiskname("xss注入攻击");
                        riskBean.setRiskcode(riskcode);
                        //System.out.println(riskBean.toString());
                        list.add(riskBean);
                    }
                }
            }
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
            try {
                bufferedReader.close();
            } catch (IOException e) {
                e.printStackTrace();
            }
        }

        return list;
    }


}